CVE-2024-3899: Enviragallery Envira Gallery

Medium severity, CVSS 4.8. EPSS: 0.4% chance of exploitation in the next 30 days.

The Gallery Plugin for WordPress WordPress plugin before 1.8.15 does not sanitise and escape some of its image settings, which could allow users with post-writing privilege such as Author to perform Cross-Site Scripting attacks.

Affected products

• Enviragallery Envira Gallery: before 1.8.15 (fixed in 1.8.15)

Published 2024-09-11. Last modified 2026-06-17.